@lark-apaas/express-core 0.0.1

package/LICENSE

@@ -0,0 +1,13 @@
+MIT License
+
+Copyright (c) 2024 Lark Technologies Pte. Ltd. and/or its affiliates
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted,provided that the above copyright notice and this permission notice appear in all copies.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE
+INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO
+EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -0,0 +1,153 @@
+# @lark-apaas/express-core
+
+Express 技术栈的平台核心框架，通过 `setup()` 一次性注册所有平台中间件，将平台逻辑与业务逻辑在框架层解耦。
+
+## 功能特性
+
+- 自动注册平台中间件链（UserContext、CSRF、RLS、ViewContext）
+- 集成 DataPaaS 数据库连接管理与 RLS 支持
+- CSRF Token 生成与验证
+- 应用元数据自动注入到模板渲染上下文
+- ESM live binding 导出 `db` 实例，使用体验与社区一致
+
+## 安装
+
+```bash
+npm install @lark-apaas/express-core
+```
+
+### Peer Dependencies
+
+```bash
+npm install drizzle-orm@0.44.6 express
+```
+
+## 快速开始
+
+### 1. 初始化应用
+
+```typescript
+// app.ts
+import express from 'express';
+import { setup } from '@lark-apaas/express-core';
+
+const app = express();
+const { close } = setup(app);
+
+// 业务路由
+app.get('/api/users', async (req, res) => { ... });
+
+app.listen(3000);
+process.on('SIGTERM', () => close());
+```
+
+### 2. 使用数据库
+
+```typescript
+// routes/users.ts
+import { db } from '@lark-apaas/express-core';
+import { users } from '../schema';
+
+router.get('/users', async (req, res) => {
+  const result = await db.select().from(users);
+  res.json(result);
+});
+```
+
+### 3. 访问用户上下文
+
+```typescript
+app.get('/api/profile', (req, res) => {
+  const { userId, tenantId, roles } = req.userContext;
+  res.json({ userId, tenantId, roles });
+});
+```
+
+### 4. 访问平台数据（模板渲染）
+
+```typescript
+app.get('/', (req, res) => {
+  // res.locals 已自动注入 appName, csrfToken 等
+  res.render('index');
+});
+```
+
+## API 参考
+
+### setup(app, config?)
+
+初始化 Express 应用，注册所有平台中间件。
+
+**参数：**
+
+| 参数 | 类型 | 说明 |
+|------|------|------|
+| `app` | `express.Application` | Express 实例 |
+| `config` | `SetupConfig` | 可选配置 |
+
+**返回值：** `{ close: () => Promise<void> }` — 用于优雅关闭数据库连接。
+
+**SetupConfig：**
+
+| 字段 | 类型 | 默认值 | 说明 |
+|------|------|--------|------|
+| `database.connectionString` | `string` | `process.env.DATABASE_URL` | PostgreSQL 连接串 |
+| `database.schema` | `object` | - | Drizzle schema |
+| `database.maxConnections` | `number` | `1` | 最大连接数 |
+| `csrf.enabled` | `boolean` | `true` | 是否启用 CSRF 保护 |
+| `csrf.cookieKey` | `string` | `'suda-csrf-token'` | CSRF cookie 名称 |
+| `csrf.headerKey` | `string` | `'x-suda-csrf-token'` | CSRF header 名称 |
+| `csrf.routes` | `string[]` | `['/api/*']` | CSRF 验证路由 |
+| `bodyLimit` | `string` | `'1mb'` | body parser 大小限制 |
+
+### db
+
+通过 ESM live binding 导出的 Drizzle 数据库实例。`setup()` 调用后可用。
+
+```typescript
+import { db } from '@lark-apaas/express-core';
+```
+
+### 中间件（高级用法）
+
+各中间件也单独导出，供高级用户自行组合：
+
+```typescript
+import {
+  userContextMiddleware,
+  createCsrfTokenMiddleware,
+  createCsrfValidationMiddleware,
+  createViewContextMiddleware,
+} from '@lark-apaas/express-core';
+```
+
+## setup() 注册的中间件顺序
+
+| 顺序 | 中间件 | 作用域 | 说明 |
+|------|--------|--------|------|
+| 1 | body parser | 所有路由 | JSON + URL-encoded 解析 |
+| 2 | cookie-parser | 所有路由 | Cookie 解析 |
+| 3 | userContextMiddleware | 所有路由 | 从请求头解析用户上下文 |
+| 4 | DataPaaS + RLS | 所有路由 | 数据库连接 + 行级安全 |
+| 5 | csrfTokenMiddleware | 所有路由 | 生成 CSRF Token |
+| 6 | csrfValidationMiddleware | `/api/*` | 验证 CSRF Token |
+| 7 | viewContextMiddleware | 所有路由 | 注入应用元数据到渲染上下文 |
+
+## req 扩展字段
+
+| 字段 | 类型 | 来源 |
+|------|------|------|
+| `req.userContext` | `UserContext` | userContextMiddleware |
+| `req.csrfToken` | `string` | csrfTokenMiddleware |
+| `req.__platform_data__` | `object` | viewContextMiddleware |
+
+## 注意事项
+
+1. `setup()` 必须在注册业务路由之前调用
+2. `db` 在 `setup()` 调用前为 `undefined`
+3. 不传 `database.connectionString` 时自动读取 `process.env.DATABASE_URL`
+4. drizzle-orm 必须为 `0.44.6` 版本
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,351 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  createCsrfTokenMiddleware: () => createCsrfTokenMiddleware,
+  createCsrfValidationMiddleware: () => createCsrfValidationMiddleware,
+  createViewContextMiddleware: () => createViewContextMiddleware,
+  db: () => db,
+  safeEscape: () => safeEscape,
+  safeStringify: () => safeStringify,
+  setup: () => setup,
+  userContextMiddleware: () => userContextMiddleware
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/setup.ts
+var import_express = __toESM(require("express"), 1);
+var import_cookie_parser = __toESM(require("cookie-parser"), 1);
+var import_express_datapaas = require("@lark-apaas/express-datapaas");
+
+// src/middlewares/user-context.ts
+var SUDA_WEB_USER_HEADER_KEY = "x-larkgw-suda-webuser";
+function getWebUserFromHeader(req) {
+  const sudaWebUserContent = req.headers[SUDA_WEB_USER_HEADER_KEY];
+  if (!sudaWebUserContent) {
+    return null;
+  }
+  try {
+    const sudaWebUserJsonStr = decodeURIComponent(sudaWebUserContent);
+    return JSON.parse(sudaWebUserJsonStr);
+  } catch (err) {
+    console.error("parse suda webuser from header failed, err=%o", err);
+    return null;
+  }
+}
+__name(getWebUserFromHeader, "getWebUserFromHeader");
+function userContextMiddleware(req, _res, next) {
+  const webUser = getWebUserFromHeader(req);
+  req.userContext = {
+    userId: webUser?.user_id,
+    tenantId: webUser?.tenant_id,
+    appId: webUser?.app_id ?? "",
+    loginUrl: webUser?.login_url ?? "",
+    userType: webUser?.user_type ?? "",
+    env: webUser?.env ?? "runtime",
+    userName: webUser?.user_name?.zh_cn ?? "",
+    userNameEn: webUser?.user_name?.en_us ?? "",
+    userNameI18n: webUser?.user_name ?? {},
+    isSystemAccount: webUser?.is_system_account ?? false,
+    roles: webUser?.roles
+  };
+  next();
+}
+__name(userContextMiddleware, "userContextMiddleware");
+
+// src/middlewares/csrf-token.ts
+var import_crypto = __toESM(require("crypto"), 1);
+function pathToRegex(pattern) {
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+__name(pathToRegex, "pathToRegex");
+function resolveOptions(options) {
+  return {
+    cookieKey: options.cookieKey ?? "suda-csrf-token",
+    cookieMaxAge: options.cookieMaxAge ?? 1e3 * 60 * 60 * 24 * 30,
+    cookiePath: options.cookiePath ?? "/",
+    exclude: (options.exclude ?? []).map(pathToRegex)
+  };
+}
+__name(resolveOptions, "resolveOptions");
+function genToken() {
+  const ts = Math.floor(Date.now() / 1e3);
+  const randInt64 = BigInt("0x" + import_crypto.default.randomBytes(8).toString("hex")).toString();
+  const s = `${randInt64}.${ts}`;
+  const sha1 = import_crypto.default.createHash("sha1");
+  sha1.update(s);
+  return `${sha1.digest("hex")}-${ts}`;
+}
+__name(genToken, "genToken");
+function createCsrfTokenMiddleware(options) {
+  const resolved = resolveOptions(options ?? {});
+  return /* @__PURE__ */ __name(function csrfTokenMiddleware(req, res, next) {
+    const pathname = req.path;
+    if (resolved.exclude.some((re) => re.test(pathname))) {
+      return next();
+    }
+    const { cookieKey, cookieMaxAge, cookiePath } = resolved;
+    const originToken = req.cookies[cookieKey.toLowerCase()];
+    if (originToken) {
+      req.csrfToken = originToken;
+    } else {
+      const token = genToken();
+      req.csrfToken = token;
+      res.cookie(cookieKey, token, {
+        maxAge: cookieMaxAge,
+        path: cookiePath,
+        httpOnly: false,
+        secure: true,
+        sameSite: "none",
+        partitioned: true
+      });
+    }
+    next();
+  }, "csrfTokenMiddleware");
+}
+__name(createCsrfTokenMiddleware, "createCsrfTokenMiddleware");
+
+// src/middlewares/csrf-validation.ts
+function resolveOptions2(options) {
+  return {
+    headerKey: options.headerKey ?? "x-suda-csrf-token",
+    cookieKey: options.cookieKey ?? "suda-csrf-token"
+  };
+}
+__name(resolveOptions2, "resolveOptions");
+function sendForbidden(res, message) {
+  res.status(403).send(`Forbidden\uFF0C${message}`);
+}
+__name(sendForbidden, "sendForbidden");
+function createCsrfValidationMiddleware(options) {
+  const resolved = resolveOptions2(options ?? {});
+  return /* @__PURE__ */ __name(function csrfValidationMiddleware(req, res, next) {
+    const { headerKey, cookieKey } = resolved;
+    const cookieCsrfToken = req.cookies[cookieKey.toLowerCase()];
+    if (!cookieCsrfToken) {
+      sendForbidden(res, "csrf token not found in cookie.");
+      return;
+    }
+    const headerCsrfToken = req.headers[headerKey.toLowerCase()];
+    if (!headerCsrfToken) {
+      sendForbidden(res, "csrf token not found in header.");
+      return;
+    }
+    if (cookieCsrfToken !== headerCsrfToken) {
+      sendForbidden(res, "csrf token not match.");
+      return;
+    }
+    next();
+  }, "csrfValidationMiddleware");
+}
+__name(createCsrfValidationMiddleware, "createCsrfValidationMiddleware");
+
+// src/utils/platform-client.ts
+var import_http_client = require("@lark-apaas/http-client");
+var _client = null;
+function createPlatformClient() {
+  if (_client) return _client;
+  _client = new import_http_client.HttpClient({
+    timeout: 5e3,
+    platform: {
+      enabled: true
+    }
+  });
+  return _client;
+}
+__name(createPlatformClient, "createPlatformClient");
+function getPlatformClient() {
+  if (!_client) {
+    throw new Error("Platform client not initialized. Call setup() first.");
+  }
+  return _client;
+}
+__name(getPlatformClient, "getPlatformClient");
+
+// src/utils/safe-escape.ts
+function safeStringify(obj) {
+  const json = JSON.stringify(obj);
+  return safeEscape(json);
+}
+__name(safeStringify, "safeStringify");
+function safeEscape(s) {
+  return s.replace(/[<>&='"\n\r\u2028\u2029]/g, function(c) {
+    switch (c.charCodeAt(0)) {
+      case 60:
+        return "\\u003c";
+      case 62:
+        return "\\u003e";
+      case 38:
+        return "\\u0026";
+      case 61:
+        return "\\u003d";
+      case 39:
+        return "\\u0027";
+      case 34:
+        return "\\u0022";
+      case 10:
+        return "\\u000a";
+      case 13:
+        return "\\u000d";
+      case 8232:
+        return "\\u2028";
+      case 8233:
+        return "\\u2029";
+      default:
+        return c;
+    }
+  });
+}
+__name(safeEscape, "safeEscape");
+
+// src/middlewares/view-context.ts
+async function getAppInfo(appId) {
+  if (!appId) {
+    console.warn("appId is empty, skip get app info");
+    return null;
+  }
+  try {
+    const client = getPlatformClient();
+    const resp = await client.get(`/b/${appId}/get_published_v2`);
+    if (resp.status !== 200) {
+      throw new Error(`Failed to get app info, status: ${resp.status}`);
+    }
+    const data = await resp.json();
+    if (data.status_code !== "0") {
+      throw new Error(`Failed to get app info, status_code: ${data.status_code}`);
+    }
+    return data.data.app_info ?? {};
+  } catch (err) {
+    console.error("Failed to get app info", err);
+    return null;
+  }
+}
+__name(getAppInfo, "getAppInfo");
+function mapToWindowEnvironment(input) {
+  const value = (input || "").trim().toLowerCase();
+  if (value === "boe") return "staging";
+  if (value === "pre") return "gray";
+  return "online";
+}
+__name(mapToWindowEnvironment, "mapToWindowEnvironment");
+function createViewContextMiddleware() {
+  return /* @__PURE__ */ __name(async function viewContextMiddleware(req, res, next) {
+    const { userId, tenantId, appId, loginUrl, userType } = req.userContext;
+    const csrfToken = req.csrfToken;
+    const appInfo = await getAppInfo(appId);
+    const environment = mapToWindowEnvironment(process.env.FORCE_FRAMEWORK_ENVIRONMENT);
+    req.__platform_data__ = {
+      csrfToken: csrfToken ?? "",
+      userId: userId ?? "",
+      appId: appId ?? "",
+      appName: safeEscape(appInfo?.app_name ?? ""),
+      appAvatar: appInfo?.app_avatar ?? "",
+      appDescription: safeEscape(appInfo?.app_description ?? ""),
+      loginUrl: loginUrl ?? "",
+      userType: userType ?? "",
+      tenantId,
+      environment
+    };
+    res.locals = {
+      ...res.locals ?? {},
+      csrfToken: csrfToken ?? "",
+      userId: userId ?? "",
+      tenantId: tenantId ?? "",
+      loginUrl: loginUrl ?? "",
+      userType: userType ?? "",
+      appId: appId ?? "",
+      appName: safeEscape(appInfo?.app_name ?? ""),
+      appAvatar: appInfo?.app_avatar ?? "",
+      appDescription: safeEscape(appInfo?.app_description ?? ""),
+      environment
+    };
+    next();
+  }, "viewContextMiddleware");
+}
+__name(createViewContextMiddleware, "createViewContextMiddleware");
+
+// src/setup.ts
+var db;
+function setup(app, config) {
+  const bodyLimit = config?.bodyLimit ?? process.env.BODY_SIZE_LIMIT ?? "1mb";
+  app.use(import_express.default.json({
+    limit: bodyLimit
+  }));
+  app.use(import_express.default.urlencoded({
+    limit: bodyLimit,
+    extended: true
+  }));
+  app.use((0, import_cookie_parser.default)());
+  app.use(userContextMiddleware);
+  const connectionString = config?.database?.connectionString ?? process.env.DATABASE_URL ?? "";
+  const { db: database, close } = (0, import_express_datapaas.createDatabase)({
+    connectionString,
+    ...config?.database
+  });
+  db = database;
+  app.use((0, import_express_datapaas.createRlsMiddleware)());
+  const csrfEnabled = config?.csrf?.enabled ?? true;
+  if (csrfEnabled) {
+    const csrfRoutes = config?.csrf?.routes ?? [
+      "/api/*"
+    ];
+    app.use(createCsrfTokenMiddleware({
+      cookieKey: config?.csrf?.cookieKey,
+      cookieMaxAge: config?.csrf?.cookieMaxAge,
+      cookiePath: config?.csrf?.cookiePath,
+      exclude: csrfRoutes
+    }));
+    app.use(csrfRoutes, createCsrfValidationMiddleware({
+      headerKey: config?.csrf?.headerKey,
+      cookieKey: config?.csrf?.cookieKey
+    }));
+  }
+  createPlatformClient();
+  app.use(createViewContextMiddleware());
+  return {
+    close
+  };
+}
+__name(setup, "setup");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createCsrfTokenMiddleware,
+  createCsrfValidationMiddleware,
+  createViewContextMiddleware,
+  db,
+  safeEscape,
+  safeStringify,
+  setup,
+  userContextMiddleware
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/setup.ts","../src/middlewares/user-context.ts","../src/middlewares/csrf-token.ts","../src/middlewares/csrf-validation.ts","../src/utils/platform-client.ts","../src/utils/safe-escape.ts","../src/middlewares/view-context.ts"],"sourcesContent":["import './types/express.d';\n\nexport { setup, db } from './setup';\nexport type { SetupConfig } from './types/config';\nexport type { PostgresJsDatabase } from 'drizzle-orm/postgres-js';\n\nexport { safeEscape, safeStringify } from './utils/safe-escape';\n\nexport { userContextMiddleware } from './middlewares/user-context';\nexport { createCsrfTokenMiddleware } from './middlewares/csrf-token';\nexport { createCsrfValidationMiddleware } from './middlewares/csrf-validation';\nexport { createViewContextMiddleware } from './middlewares/view-context';\nexport type { CsrfTokenOptions } from './middlewares/csrf-token';\nexport type { CsrfValidationOptions } from './middlewares/csrf-validation';\n","import express from 'express';\nimport cookieParser from 'cookie-parser';\nimport { createDatabase, createRlsMiddleware } from '@lark-apaas/express-datapaas';\nimport type { PostgresJsDatabase } from 'drizzle-orm/postgres-js';\n\nimport type { SetupConfig } from './types/config';\nimport { userContextMiddleware } from './middlewares/user-context';\nimport { createCsrfTokenMiddleware } from './middlewares/csrf-token';\nimport { createCsrfValidationMiddleware } from './middlewares/csrf-validation';\nimport { createViewContextMiddleware } from './middlewares/view-context';\nimport { createPlatformClient } from './utils/platform-client';\n\n// eslint-disable-next-line import/no-mutable-exports\nexport let db: PostgresJsDatabase;\n\nexport function setup(app: express.Application, config?: SetupConfig): { close: () => Promise<void> } {\n  const bodyLimit = config?.bodyLimit ?? process.env.BODY_SIZE_LIMIT ?? '1mb';\n\n  // 1. Body parsers\n  app.use(express.json({ limit: bodyLimit }));\n  app.use(express.urlencoded({ limit: bodyLimit, extended: true }));\n\n  // 2. Cookie parser\n  app.use(cookieParser());\n\n  // 3. UserContext (all routes)\n  app.use(userContextMiddleware);\n\n  // 4. Database + RLS\n  const connectionString = config?.database?.connectionString ?? process.env.DATABASE_URL ?? '';\n  const { db: database, close } = createDatabase({\n    connectionString,\n    ...config?.database,\n  });\n  db = database;\n  app.use(createRlsMiddleware());\n\n  // 5. CSRF\n  const csrfEnabled = config?.csrf?.enabled ?? true;\n  if (csrfEnabled) {\n    const csrfRoutes = config?.csrf?.routes ?? ['/api/*'];\n\n    // 页面路由生成 token（排除 API 路由），为后续 API 请求准备 cookie\n    app.use(createCsrfTokenMiddleware({\n      cookieKey: config?.csrf?.cookieKey,\n      cookieMaxAge: config?.csrf?.cookieMaxAge,\n      cookiePath: config?.csrf?.cookiePath,\n      exclude: csrfRoutes,\n    }));\n\n    // API 路由验证 token（cookie vs header）\n    app.use(csrfRoutes, createCsrfValidationMiddleware({\n      headerKey: config?.csrf?.headerKey,\n      cookieKey: config?.csrf?.cookieKey,\n    }));\n  }\n\n  // 6. Platform client + ViewContext\n  createPlatformClient();\n  app.use(createViewContextMiddleware());\n\n  return { close };\n}\n","import type { Request, Response, NextFunction } from 'express';\n\nconst SUDA_WEB_USER_HEADER_KEY = 'x-larkgw-suda-webuser';\n\ninterface SudaWebUser {\n  user_id: string;\n  tenant_id: number;\n  app_id: string;\n  login_url: string;\n  user_type: string;\n  env: 'preview' | 'runtime';\n  user_name: Record<string, string>;\n  is_system_account?: boolean;\n  roles?: string[];\n}\n\nfunction getWebUserFromHeader(req: Request): SudaWebUser | null {\n  const sudaWebUserContent = req.headers[SUDA_WEB_USER_HEADER_KEY] as string | undefined;\n  if (!sudaWebUserContent) {\n    return null;\n  }\n  try {\n    const sudaWebUserJsonStr = decodeURIComponent(sudaWebUserContent);\n    return JSON.parse(sudaWebUserJsonStr) as SudaWebUser;\n  } catch (err) {\n    console.error('parse suda webuser from header failed, err=%o', err);\n    return null;\n  }\n}\n\nexport function userContextMiddleware(req: Request, _res: Response, next: NextFunction) {\n  const webUser = getWebUserFromHeader(req);\n  req.userContext = {\n    userId: webUser?.user_id,\n    tenantId: webUser?.tenant_id,\n    appId: webUser?.app_id ?? '',\n    loginUrl: webUser?.login_url ?? '',\n    userType: webUser?.user_type ?? '',\n    env: webUser?.env ?? 'runtime',\n    userName: webUser?.user_name?.zh_cn ?? '',\n    userNameEn: webUser?.user_name?.en_us ?? '',\n    userNameI18n: webUser?.user_name ?? {},\n    isSystemAccount: webUser?.is_system_account ?? false,\n    roles: webUser?.roles,\n  };\n  next();\n}\n","import type { Request, Response, NextFunction } from 'express';\nimport crypto from 'crypto';\n\nexport interface CsrfTokenOptions {\n  cookieKey?: string;\n  cookieMaxAge?: number;\n  cookiePath?: string;\n  /** 排除的路由模式，匹配到则跳过 token 生成 */\n  exclude?: string[];\n}\n\ninterface ResolvedCsrfTokenOptions {\n  cookieKey: string;\n  cookieMaxAge: number;\n  cookiePath: string;\n  exclude: RegExp[];\n}\n\nfunction pathToRegex(pattern: string): RegExp {\n  // 将 Express 风格的路径模式转为正则：/api/* → /^\\/api\\/.*$/\n  const escaped = pattern\n    .replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n    .replace(/\\*/g, '.*');\n  return new RegExp(`^${escaped}$`);\n}\n\nfunction resolveOptions(options: CsrfTokenOptions): ResolvedCsrfTokenOptions {\n  return {\n    cookieKey: options.cookieKey ?? 'suda-csrf-token',\n    cookieMaxAge: options.cookieMaxAge ?? 1000 * 60 * 60 * 24 * 30,\n    cookiePath: options.cookiePath ?? '/',\n    exclude: (options.exclude ?? []).map(pathToRegex),\n  };\n}\n\nfunction genToken(): string {\n  const ts = Math.floor(Date.now() / 1000);\n  const randInt64 = BigInt('0x' + crypto.randomBytes(8).toString('hex')).toString();\n  const s = `${randInt64}.${ts}`;\n  const sha1 = crypto.createHash('sha1');\n  sha1.update(s);\n  return `${sha1.digest('hex')}-${ts}`;\n}\n\nexport function createCsrfTokenMiddleware(options?: CsrfTokenOptions) {\n  const resolved = resolveOptions(options ?? {});\n\n  return function csrfTokenMiddleware(req: Request, res: Response, next: NextFunction) {\n    // 匹配排除路由则跳过\n    const pathname = req.path;\n    if (resolved.exclude.some(re => re.test(pathname))) {\n      return next();\n    }\n\n    const { cookieKey, cookieMaxAge, cookiePath } = resolved;\n    const originToken = req.cookies[cookieKey.toLowerCase()];\n\n    if (originToken) {\n      req.csrfToken = originToken;\n    } else {\n      const token = genToken();\n      req.csrfToken = token;\n      res.cookie(cookieKey, token, {\n        maxAge: cookieMaxAge,\n        path: cookiePath,\n        httpOnly: false,\n        secure: true,\n        sameSite: 'none',\n        partitioned: true,\n      });\n    }\n    next();\n  };\n}\n","import type { Request, Response, NextFunction } from 'express';\n\nexport interface CsrfValidationOptions {\n  headerKey?: string;\n  cookieKey?: string;\n}\n\ninterface ResolvedCsrfValidationOptions {\n  headerKey: string;\n  cookieKey: string;\n}\n\nfunction resolveOptions(options: CsrfValidationOptions): ResolvedCsrfValidationOptions {\n  return {\n    headerKey: options.headerKey ?? 'x-suda-csrf-token',\n    cookieKey: options.cookieKey ?? 'suda-csrf-token',\n  };\n}\n\nfunction sendForbidden(res: Response, message: string) {\n  res.status(403).send(`Forbidden，${message}`);\n}\n\nexport function createCsrfValidationMiddleware(options?: CsrfValidationOptions) {\n  const resolved = resolveOptions(options ?? {});\n\n  return function csrfValidationMiddleware(req: Request, res: Response, next: NextFunction) {\n    const { headerKey, cookieKey } = resolved;\n\n    const cookieCsrfToken = req.cookies[cookieKey.toLowerCase()];\n    if (!cookieCsrfToken) {\n      sendForbidden(res, 'csrf token not found in cookie.');\n      return;\n    }\n\n    const headerCsrfToken = req.headers[headerKey.toLowerCase()];\n    if (!headerCsrfToken) {\n      sendForbidden(res, 'csrf token not found in header.');\n      return;\n    }\n\n    if (cookieCsrfToken !== headerCsrfToken) {\n      sendForbidden(res, 'csrf token not match.');\n      return;\n    }\n\n    next();\n  };\n}\n","import { HttpClient } from '@lark-apaas/http-client';\n\nlet _client: HttpClient | null = null;\n\nexport function createPlatformClient(): HttpClient {\n  if (_client) return _client;\n  _client = new HttpClient({\n    timeout: 5000,\n    platform: { enabled: true },\n  });\n  return _client;\n}\n\nexport function getPlatformClient(): HttpClient {\n  if (!_client) {\n    throw new Error('Platform client not initialized. Call setup() first.');\n  }\n  return _client;\n}\n","/**\n * 安全转义的 Json Stringify，模版渲染的 JSON 对象需要调用 safeStringify，而不是用原生的 JSON.stringify。\n * 抄 gson 的实现: https://github.com/google/gson/blob/49ddab9eeb6cbac686711deca6001d40e8d8500d/gson/src/main/java/com/google/gson/stream/JsonWriter.java\n * 将 json 的敏感字符转换为 unicode, 避免 xss\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport function safeStringify(obj: any) {\n  const json = JSON.stringify(obj);\n  return safeEscape(json);\n}\n\nenum EscapedChar {\n  LT = 0x3c, // <\n  GT = 0x3e, // >\n  AMP = 0x26, // &\n  APO = 0x27, // '\n  QUOT = 0x22, // \"\n  EQUAL = 0x3d, // =\n  LF = 0x0a, // \\n\n  CR = 0x0d, // \\r\n  LS = 0x2028, // 行分隔符\n  PS = 0x2029, // 段落分隔符\n}\n\nexport function safeEscape(s: string) {\n  return s.replace(/[<>&='\"\\n\\r\\u2028\\u2029]/g, function (c) {\n    switch (c.charCodeAt(0)) {\n      case EscapedChar.LT:\n        return '\\\\u003c';\n      case EscapedChar.GT:\n        return '\\\\u003e';\n      case EscapedChar.AMP:\n        return '\\\\u0026';\n      case EscapedChar.EQUAL:\n        return '\\\\u003d';\n      case EscapedChar.APO:\n        return '\\\\u0027';\n      case EscapedChar.QUOT:\n        return '\\\\u0022';\n      case EscapedChar.LF:\n        return '\\\\u000a';\n      case EscapedChar.CR:\n        return '\\\\u000d';\n      case EscapedChar.LS:\n        return '\\\\u2028';\n      case EscapedChar.PS:\n        return '\\\\u2029';\n      default:\n        return c;\n    }\n  });\n}\n","import type { Request, Response, NextFunction } from 'express';\nimport { getPlatformClient } from '../utils/platform-client';\nimport { safeEscape } from '../utils/safe-escape';\n\ninterface GetAppInfoResponse {\n  status_code: string;\n  data: {\n    status_code: number;\n    app_info: {\n      app_name: string;\n      app_description: string;\n      app_avatar: string;\n    };\n    app_runtime_extra: {\n      url: string;\n      bucket: string;\n    };\n  };\n}\n\nasync function getAppInfo(appId?: string) {\n  if (!appId) {\n    console.warn('appId is empty, skip get app info');\n    return null;\n  }\n  try {\n    const client = getPlatformClient();\n    const resp = await client.get(`/b/${appId}/get_published_v2`);\n    if (resp.status !== 200) {\n      throw new Error(`Failed to get app info, status: ${resp.status}`);\n    }\n    const data = (await resp.json()) as GetAppInfoResponse;\n    if (data.status_code !== '0') {\n      throw new Error(`Failed to get app info, status_code: ${data.status_code}`);\n    }\n    return data.data.app_info ?? {};\n  } catch (err) {\n    console.error('Failed to get app info', err);\n    return null;\n  }\n}\n\nfunction mapToWindowEnvironment(input?: string): string {\n  const value = (input || '').trim().toLowerCase();\n  if (value === 'boe') return 'staging';\n  if (value === 'pre') return 'gray';\n  return 'online';\n}\n\nexport function createViewContextMiddleware() {\n  return async function viewContextMiddleware(req: Request, res: Response, next: NextFunction) {\n    const { userId, tenantId, appId, loginUrl, userType } = req.userContext;\n    const csrfToken = req.csrfToken;\n    const appInfo = await getAppInfo(appId);\n    const environment = mapToWindowEnvironment(process.env.FORCE_FRAMEWORK_ENVIRONMENT);\n\n    req.__platform_data__ = {\n      csrfToken: csrfToken ?? '',\n      userId: userId ?? '',\n      appId: appId ?? '',\n      appName: safeEscape(appInfo?.app_name ?? ''),\n      appAvatar: appInfo?.app_avatar ?? '',\n      appDescription: safeEscape(appInfo?.app_description ?? ''),\n      loginUrl: loginUrl ?? '',\n      userType: userType ?? '',\n      tenantId,\n      environment,\n    };\n\n    res.locals = {\n      ...(res.locals ?? {}),\n      csrfToken: csrfToken ?? '',\n      userId: userId ?? '',\n      tenantId: tenantId ?? '',\n      loginUrl: loginUrl ?? '',\n      userType: userType ?? '',\n      appId: appId ?? '',\n      appName: safeEscape(appInfo?.app_name ?? ''),\n      appAvatar: appInfo?.app_avatar ?? '',\n      appDescription: safeEscape(appInfo?.app_description ?? ''),\n      environment,\n    };\n\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;ACAA,qBAAoB;AACpB,2BAAyB;AACzB,8BAAoD;;;ACApD,IAAMA,2BAA2B;AAcjC,SAASC,qBAAqBC,KAAY;AACxC,QAAMC,qBAAqBD,IAAIE,QAAQJ,wBAAAA;AACvC,MAAI,CAACG,oBAAoB;AACvB,WAAO;EACT;AACA,MAAI;AACF,UAAME,qBAAqBC,mBAAmBH,kBAAAA;AAC9C,WAAOI,KAAKC,MAAMH,kBAAAA;EACpB,SAASI,KAAK;AACZC,YAAQC,MAAM,iDAAiDF,GAAAA;AAC/D,WAAO;EACT;AACF;AAZSR;AAcF,SAASW,sBAAsBV,KAAcW,MAAgBC,MAAkB;AACpF,QAAMC,UAAUd,qBAAqBC,GAAAA;AACrCA,MAAIc,cAAc;IAChBC,QAAQF,SAASG;IACjBC,UAAUJ,SAASK;IACnBC,OAAON,SAASO,UAAU;IAC1BC,UAAUR,SAASS,aAAa;IAChCC,UAAUV,SAASW,aAAa;IAChCC,KAAKZ,SAASY,OAAO;IACrBC,UAAUb,SAASc,WAAWC,SAAS;IACvCC,YAAYhB,SAASc,WAAWG,SAAS;IACzCC,cAAclB,SAASc,aAAa,CAAC;IACrCK,iBAAiBnB,SAASoB,qBAAqB;IAC/CC,OAAOrB,SAASqB;EAClB;AACAtB,OAAAA;AACF;AAhBgBF;;;AC7BhB,oBAAmB;AAiBnB,SAASyB,YAAYC,SAAe;AAElC,QAAMC,UAAUD,QACbE,QAAQ,sBAAsB,MAAA,EAC9BA,QAAQ,OAAO,IAAA;AAClB,SAAO,IAAIC,OAAO,IAAIF,OAAAA,GAAU;AAClC;AANSF;AAQT,SAASK,eAAeC,SAAyB;AAC/C,SAAO;IACLC,WAAWD,QAAQC,aAAa;IAChCC,cAAcF,QAAQE,gBAAgB,MAAO,KAAK,KAAK,KAAK;IAC5DC,YAAYH,QAAQG,cAAc;IAClCC,UAAUJ,QAAQI,WAAW,CAAA,GAAIC,IAAIX,WAAAA;EACvC;AACF;AAPSK;AAST,SAASO,WAAAA;AACP,QAAMC,KAAKC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;AACnC,QAAMC,YAAYC,OAAO,OAAOC,cAAAA,QAAOC,YAAY,CAAA,EAAGC,SAAS,KAAA,CAAA,EAAQA,SAAQ;AAC/E,QAAMC,IAAI,GAAGL,SAAAA,IAAaL,EAAAA;AAC1B,QAAMW,OAAOJ,cAAAA,QAAOK,WAAW,MAAA;AAC/BD,OAAKE,OAAOH,CAAAA;AACZ,SAAO,GAAGC,KAAKG,OAAO,KAAA,CAAA,IAAUd,EAAAA;AAClC;AAPSD;AASF,SAASgB,0BAA0BtB,SAA0B;AAClE,QAAMuB,WAAWxB,eAAeC,WAAW,CAAC,CAAA;AAE5C,SAAO,gCAASwB,oBAAoBC,KAAcC,KAAeC,MAAkB;AAEjF,UAAMC,WAAWH,IAAII;AACrB,QAAIN,SAASnB,QAAQ0B,KAAKC,CAAAA,OAAMA,GAAGC,KAAKJ,QAAAA,CAAAA,GAAY;AAClD,aAAOD,KAAAA;IACT;AAEA,UAAM,EAAE1B,WAAWC,cAAcC,WAAU,IAAKoB;AAChD,UAAMU,cAAcR,IAAIS,QAAQjC,UAAUkC,YAAW,CAAA;AAErD,QAAIF,aAAa;AACfR,UAAIW,YAAYH;IAClB,OAAO;AACL,YAAMI,QAAQ/B,SAAAA;AACdmB,UAAIW,YAAYC;AAChBX,UAAIY,OAAOrC,WAAWoC,OAAO;QAC3BE,QAAQrC;QACR2B,MAAM1B;QACNqC,UAAU;QACVC,QAAQ;QACRC,UAAU;QACVC,aAAa;MACf,CAAA;IACF;AACAhB,SAAAA;EACF,GAzBO;AA0BT;AA7BgBL;;;AChChB,SAASsB,gBAAeC,SAA8B;AACpD,SAAO;IACLC,WAAWD,QAAQC,aAAa;IAChCC,WAAWF,QAAQE,aAAa;EAClC;AACF;AALSH,OAAAA,iBAAAA;AAOT,SAASI,cAAcC,KAAeC,SAAe;AACnDD,MAAIE,OAAO,GAAA,EAAKC,KAAK,kBAAaF,OAAAA,EAAS;AAC7C;AAFSF;AAIF,SAASK,+BAA+BR,SAA+B;AAC5E,QAAMS,WAAWV,gBAAeC,WAAW,CAAC,CAAA;AAE5C,SAAO,gCAASU,yBAAyBC,KAAcP,KAAeQ,MAAkB;AACtF,UAAM,EAAEX,WAAWC,UAAS,IAAKO;AAEjC,UAAMI,kBAAkBF,IAAIG,QAAQZ,UAAUa,YAAW,CAAA;AACzD,QAAI,CAACF,iBAAiB;AACpBV,oBAAcC,KAAK,iCAAA;AACnB;IACF;AAEA,UAAMY,kBAAkBL,IAAIM,QAAQhB,UAAUc,YAAW,CAAA;AACzD,QAAI,CAACC,iBAAiB;AACpBb,oBAAcC,KAAK,iCAAA;AACnB;IACF;AAEA,QAAIS,oBAAoBG,iBAAiB;AACvCb,oBAAcC,KAAK,uBAAA;AACnB;IACF;AAEAQ,SAAAA;EACF,GArBO;AAsBT;AAzBgBJ;;;ACvBhB,yBAA2B;AAE3B,IAAIU,UAA6B;AAE1B,SAASC,uBAAAA;AACd,MAAID,QAAS,QAAOA;AACpBA,YAAU,IAAIE,8BAAW;IACvBC,SAAS;IACTC,UAAU;MAAEC,SAAS;IAAK;EAC5B,CAAA;AACA,SAAOL;AACT;AAPgBC;AAST,SAASK,oBAAAA;AACd,MAAI,CAACN,SAAS;AACZ,UAAM,IAAIO,MAAM,sDAAA;EAClB;AACA,SAAOP;AACT;AALgBM;;;ACPT,SAASE,cAAcC,KAAQ;AACpC,QAAMC,OAAOC,KAAKC,UAAUH,GAAAA;AAC5B,SAAOI,WAAWH,IAAAA;AACpB;AAHgBF;AAkBT,SAASM,WAAWC,GAAS;AAClC,SAAOA,EAAEC,QAAQ,6BAA6B,SAAUC,GAAC;AACvD,YAAQA,EAAEC,WAAW,CAAA,GAAA;MACnB,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT;AACE,eAAOD;IACX;EACF,CAAA;AACF;AA3BgBH;;;ACJhB,eAAeK,WAAWC,OAAc;AACtC,MAAI,CAACA,OAAO;AACVC,YAAQC,KAAK,mCAAA;AACb,WAAO;EACT;AACA,MAAI;AACF,UAAMC,SAASC,kBAAAA;AACf,UAAMC,OAAO,MAAMF,OAAOG,IAAI,MAAMN,KAAAA,mBAAwB;AAC5D,QAAIK,KAAKE,WAAW,KAAK;AACvB,YAAM,IAAIC,MAAM,mCAAmCH,KAAKE,MAAM,EAAE;IAClE;AACA,UAAME,OAAQ,MAAMJ,KAAKK,KAAI;AAC7B,QAAID,KAAKE,gBAAgB,KAAK;AAC5B,YAAM,IAAIH,MAAM,wCAAwCC,KAAKE,WAAW,EAAE;IAC5E;AACA,WAAOF,KAAKA,KAAKG,YAAY,CAAC;EAChC,SAASC,KAAK;AACZZ,YAAQa,MAAM,0BAA0BD,GAAAA;AACxC,WAAO;EACT;AACF;AApBed;AAsBf,SAASgB,uBAAuBC,OAAc;AAC5C,QAAMC,SAASD,SAAS,IAAIE,KAAI,EAAGC,YAAW;AAC9C,MAAIF,UAAU,MAAO,QAAO;AAC5B,MAAIA,UAAU,MAAO,QAAO;AAC5B,SAAO;AACT;AALSF;AAOF,SAASK,8BAAAA;AACd,SAAO,sCAAeC,sBAAsBC,KAAcC,KAAeC,MAAkB;AACzF,UAAM,EAAEC,QAAQC,UAAU1B,OAAO2B,UAAUC,SAAQ,IAAKN,IAAIO;AAC5D,UAAMC,YAAYR,IAAIQ;AACtB,UAAMC,UAAU,MAAMhC,WAAWC,KAAAA;AACjC,UAAMgC,cAAcjB,uBAAuBkB,QAAQC,IAAIC,2BAA2B;AAElFb,QAAIc,oBAAoB;MACtBN,WAAWA,aAAa;MACxBL,QAAQA,UAAU;MAClBzB,OAAOA,SAAS;MAChBqC,SAASC,WAAWP,SAASQ,YAAY,EAAA;MACzCC,WAAWT,SAASU,cAAc;MAClCC,gBAAgBJ,WAAWP,SAASY,mBAAmB,EAAA;MACvDhB,UAAUA,YAAY;MACtBC,UAAUA,YAAY;MACtBF;MACAM;IACF;AAEAT,QAAIqB,SAAS;MACX,GAAIrB,IAAIqB,UAAU,CAAC;MACnBd,WAAWA,aAAa;MACxBL,QAAQA,UAAU;MAClBC,UAAUA,YAAY;MACtBC,UAAUA,YAAY;MACtBC,UAAUA,YAAY;MACtB5B,OAAOA,SAAS;MAChBqC,SAASC,WAAWP,SAASQ,YAAY,EAAA;MACzCC,WAAWT,SAASU,cAAc;MAClCC,gBAAgBJ,WAAWP,SAASY,mBAAmB,EAAA;MACvDX;IACF;AAEAR,SAAAA;EACF,GAlCO;AAmCT;AApCgBJ;;;ANpCT,IAAIyB;AAEJ,SAASC,MAAMC,KAA0BC,QAAoB;AAClE,QAAMC,YAAYD,QAAQC,aAAaC,QAAQC,IAAIC,mBAAmB;AAGtEL,MAAIM,IAAIC,eAAAA,QAAQC,KAAK;IAAEC,OAAOP;EAAU,CAAA,CAAA;AACxCF,MAAIM,IAAIC,eAAAA,QAAQG,WAAW;IAAED,OAAOP;IAAWS,UAAU;EAAK,CAAA,CAAA;AAG9DX,MAAIM,QAAIM,qBAAAA,SAAAA,CAAAA;AAGRZ,MAAIM,IAAIO,qBAAAA;AAGR,QAAMC,mBAAmBb,QAAQc,UAAUD,oBAAoBX,QAAQC,IAAIY,gBAAgB;AAC3F,QAAM,EAAElB,IAAIiB,UAAUE,MAAK,QAAKC,wCAAe;IAC7CJ;IACA,GAAGb,QAAQc;EACb,CAAA;AACAjB,OAAKiB;AACLf,MAAIM,QAAIa,6CAAAA,CAAAA;AAGR,QAAMC,cAAcnB,QAAQoB,MAAMC,WAAW;AAC7C,MAAIF,aAAa;AACf,UAAMG,aAAatB,QAAQoB,MAAMG,UAAU;MAAC;;AAG5CxB,QAAIM,IAAImB,0BAA0B;MAChCC,WAAWzB,QAAQoB,MAAMK;MACzBC,cAAc1B,QAAQoB,MAAMM;MAC5BC,YAAY3B,QAAQoB,MAAMO;MAC1BC,SAASN;IACX,CAAA,CAAA;AAGAvB,QAAIM,IAAIiB,YAAYO,+BAA+B;MACjDC,WAAW9B,QAAQoB,MAAMU;MACzBL,WAAWzB,QAAQoB,MAAMK;IAC3B,CAAA,CAAA;EACF;AAGAM,uBAAAA;AACAhC,MAAIM,IAAI2B,4BAAAA,CAAAA;AAER,SAAO;IAAEhB;EAAM;AACjB;AA/CgBlB;","names":["SUDA_WEB_USER_HEADER_KEY","getWebUserFromHeader","req","sudaWebUserContent","headers","sudaWebUserJsonStr","decodeURIComponent","JSON","parse","err","console","error","userContextMiddleware","_res","next","webUser","userContext","userId","user_id","tenantId","tenant_id","appId","app_id","loginUrl","login_url","userType","user_type","env","userName","user_name","zh_cn","userNameEn","en_us","userNameI18n","isSystemAccount","is_system_account","roles","pathToRegex","pattern","escaped","replace","RegExp","resolveOptions","options","cookieKey","cookieMaxAge","cookiePath","exclude","map","genToken","ts","Math","floor","Date","now","randInt64","BigInt","crypto","randomBytes","toString","s","sha1","createHash","update","digest","createCsrfTokenMiddleware","resolved","csrfTokenMiddleware","req","res","next","pathname","path","some","re","test","originToken","cookies","toLowerCase","csrfToken","token","cookie","maxAge","httpOnly","secure","sameSite","partitioned","resolveOptions","options","headerKey","cookieKey","sendForbidden","res","message","status","send","createCsrfValidationMiddleware","resolved","csrfValidationMiddleware","req","next","cookieCsrfToken","cookies","toLowerCase","headerCsrfToken","headers","_client","createPlatformClient","HttpClient","timeout","platform","enabled","getPlatformClient","Error","safeStringify","obj","json","JSON","stringify","safeEscape","safeEscape","s","replace","c","charCodeAt","getAppInfo","appId","console","warn","client","getPlatformClient","resp","get","status","Error","data","json","status_code","app_info","err","error","mapToWindowEnvironment","input","value","trim","toLowerCase","createViewContextMiddleware","viewContextMiddleware","req","res","next","userId","tenantId","loginUrl","userType","userContext","csrfToken","appInfo","environment","process","env","FORCE_FRAMEWORK_ENVIRONMENT","__platform_data__","appName","safeEscape","app_name","appAvatar","app_avatar","appDescription","app_description","locals","db","setup","app","config","bodyLimit","process","env","BODY_SIZE_LIMIT","use","express","json","limit","urlencoded","extended","cookieParser","userContextMiddleware","connectionString","database","DATABASE_URL","close","createDatabase","createRlsMiddleware","csrfEnabled","csrf","enabled","csrfRoutes","routes","createCsrfTokenMiddleware","cookieKey","cookieMaxAge","cookiePath","exclude","createCsrfValidationMiddleware","headerKey","createPlatformClient","createViewContextMiddleware"]}

package/dist/index.d.cts

@@ -0,0 +1,78 @@
+import express, { Request, Response, NextFunction } from 'express';
+import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+export { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+import { CreateDatabaseConfig } from '@lark-apaas/express-datapaas';
+
+declare global {
+  namespace Express {
+    interface Request {
+      __platform_data__?: {
+        userId?: string;
+        tenantId?: number;
+        csrfToken?: string;
+        [key: string]: unknown;
+      };
+      userContext: {
+        userId?: string;
+        tenantId?: number;
+        appId?: string;
+        loginUrl?: string;
+        userType?: string;
+        env?: 'preview' | 'runtime';
+        userName?: string;
+        userNameEn?: string;
+        userNameI18n?: Record<string, string>;
+        isSystemAccount?: boolean;
+        roles?: string[];
+      };
+      csrfToken?: string;
+    }
+  }
+}
+
+interface SetupConfig {
+    database?: Partial<CreateDatabaseConfig>;
+    csrf?: {
+        enabled?: boolean;
+        cookieKey?: string;
+        headerKey?: string;
+        cookieMaxAge?: number;
+        cookiePath?: string;
+        routes?: string[];
+    };
+    bodyLimit?: string;
+}
+
+declare let db: PostgresJsDatabase;
+declare function setup(app: express.Application, config?: SetupConfig): {
+    close: () => Promise<void>;
+};
+
+/**
+ * 安全转义的 Json Stringify，模版渲染的 JSON 对象需要调用 safeStringify，而不是用原生的 JSON.stringify。
+ * 抄 gson 的实现: https://github.com/google/gson/blob/49ddab9eeb6cbac686711deca6001d40e8d8500d/gson/src/main/java/com/google/gson/stream/JsonWriter.java
+ * 将 json 的敏感字符转换为 unicode, 避免 xss
+ */
+declare function safeStringify(obj: any): string;
+declare function safeEscape(s: string): string;
+
+declare function userContextMiddleware(req: Request, _res: Response, next: NextFunction): void;
+
+interface CsrfTokenOptions {
+    cookieKey?: string;
+    cookieMaxAge?: number;
+    cookiePath?: string;
+    /** 排除的路由模式，匹配到则跳过 token 生成 */
+    exclude?: string[];
+}
+declare function createCsrfTokenMiddleware(options?: CsrfTokenOptions): (req: Request, res: Response, next: NextFunction) => void;
+
+interface CsrfValidationOptions {
+    headerKey?: string;
+    cookieKey?: string;
+}
+declare function createCsrfValidationMiddleware(options?: CsrfValidationOptions): (req: Request, res: Response, next: NextFunction) => void;
+
+declare function createViewContextMiddleware(): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+
+export { type CsrfTokenOptions, type CsrfValidationOptions, type SetupConfig, createCsrfTokenMiddleware, createCsrfValidationMiddleware, createViewContextMiddleware, db, safeEscape, safeStringify, setup, userContextMiddleware };

package/dist/index.d.ts

@@ -0,0 +1,78 @@
+import express, { Request, Response, NextFunction } from 'express';
+import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+export { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+import { CreateDatabaseConfig } from '@lark-apaas/express-datapaas';
+
+declare global {
+  namespace Express {
+    interface Request {
+      __platform_data__?: {
+        userId?: string;
+        tenantId?: number;
+        csrfToken?: string;
+        [key: string]: unknown;
+      };
+      userContext: {
+        userId?: string;
+        tenantId?: number;
+        appId?: string;
+        loginUrl?: string;
+        userType?: string;
+        env?: 'preview' | 'runtime';
+        userName?: string;
+        userNameEn?: string;
+        userNameI18n?: Record<string, string>;
+        isSystemAccount?: boolean;
+        roles?: string[];
+      };
+      csrfToken?: string;
+    }
+  }
+}
+
+interface SetupConfig {
+    database?: Partial<CreateDatabaseConfig>;
+    csrf?: {
+        enabled?: boolean;
+        cookieKey?: string;
+        headerKey?: string;
+        cookieMaxAge?: number;
+        cookiePath?: string;
+        routes?: string[];
+    };
+    bodyLimit?: string;
+}
+
+declare let db: PostgresJsDatabase;
+declare function setup(app: express.Application, config?: SetupConfig): {
+    close: () => Promise<void>;
+};
+
+/**
+ * 安全转义的 Json Stringify，模版渲染的 JSON 对象需要调用 safeStringify，而不是用原生的 JSON.stringify。
+ * 抄 gson 的实现: https://github.com/google/gson/blob/49ddab9eeb6cbac686711deca6001d40e8d8500d/gson/src/main/java/com/google/gson/stream/JsonWriter.java
+ * 将 json 的敏感字符转换为 unicode, 避免 xss
+ */
+declare function safeStringify(obj: any): string;
+declare function safeEscape(s: string): string;
+
+declare function userContextMiddleware(req: Request, _res: Response, next: NextFunction): void;
+
+interface CsrfTokenOptions {
+    cookieKey?: string;
+    cookieMaxAge?: number;
+    cookiePath?: string;
+    /** 排除的路由模式，匹配到则跳过 token 生成 */
+    exclude?: string[];
+}
+declare function createCsrfTokenMiddleware(options?: CsrfTokenOptions): (req: Request, res: Response, next: NextFunction) => void;
+
+interface CsrfValidationOptions {
+    headerKey?: string;
+    cookieKey?: string;
+}
+declare function createCsrfValidationMiddleware(options?: CsrfValidationOptions): (req: Request, res: Response, next: NextFunction) => void;
+
+declare function createViewContextMiddleware(): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+
+export { type CsrfTokenOptions, type CsrfValidationOptions, type SetupConfig, createCsrfTokenMiddleware, createCsrfValidationMiddleware, createViewContextMiddleware, db, safeEscape, safeStringify, setup, userContextMiddleware };

package/dist/index.js

@@ -0,0 +1,309 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/setup.ts
+import express from "express";
+import cookieParser from "cookie-parser";
+import { createDatabase, createRlsMiddleware } from "@lark-apaas/express-datapaas";
+
+// src/middlewares/user-context.ts
+var SUDA_WEB_USER_HEADER_KEY = "x-larkgw-suda-webuser";
+function getWebUserFromHeader(req) {
+  const sudaWebUserContent = req.headers[SUDA_WEB_USER_HEADER_KEY];
+  if (!sudaWebUserContent) {
+    return null;
+  }
+  try {
+    const sudaWebUserJsonStr = decodeURIComponent(sudaWebUserContent);
+    return JSON.parse(sudaWebUserJsonStr);
+  } catch (err) {
+    console.error("parse suda webuser from header failed, err=%o", err);
+    return null;
+  }
+}
+__name(getWebUserFromHeader, "getWebUserFromHeader");
+function userContextMiddleware(req, _res, next) {
+  const webUser = getWebUserFromHeader(req);
+  req.userContext = {
+    userId: webUser?.user_id,
+    tenantId: webUser?.tenant_id,
+    appId: webUser?.app_id ?? "",
+    loginUrl: webUser?.login_url ?? "",
+    userType: webUser?.user_type ?? "",
+    env: webUser?.env ?? "runtime",
+    userName: webUser?.user_name?.zh_cn ?? "",
+    userNameEn: webUser?.user_name?.en_us ?? "",
+    userNameI18n: webUser?.user_name ?? {},
+    isSystemAccount: webUser?.is_system_account ?? false,
+    roles: webUser?.roles
+  };
+  next();
+}
+__name(userContextMiddleware, "userContextMiddleware");
+
+// src/middlewares/csrf-token.ts
+import crypto from "crypto";
+function pathToRegex(pattern) {
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+__name(pathToRegex, "pathToRegex");
+function resolveOptions(options) {
+  return {
+    cookieKey: options.cookieKey ?? "suda-csrf-token",
+    cookieMaxAge: options.cookieMaxAge ?? 1e3 * 60 * 60 * 24 * 30,
+    cookiePath: options.cookiePath ?? "/",
+    exclude: (options.exclude ?? []).map(pathToRegex)
+  };
+}
+__name(resolveOptions, "resolveOptions");
+function genToken() {
+  const ts = Math.floor(Date.now() / 1e3);
+  const randInt64 = BigInt("0x" + crypto.randomBytes(8).toString("hex")).toString();
+  const s = `${randInt64}.${ts}`;
+  const sha1 = crypto.createHash("sha1");
+  sha1.update(s);
+  return `${sha1.digest("hex")}-${ts}`;
+}
+__name(genToken, "genToken");
+function createCsrfTokenMiddleware(options) {
+  const resolved = resolveOptions(options ?? {});
+  return /* @__PURE__ */ __name(function csrfTokenMiddleware(req, res, next) {
+    const pathname = req.path;
+    if (resolved.exclude.some((re) => re.test(pathname))) {
+      return next();
+    }
+    const { cookieKey, cookieMaxAge, cookiePath } = resolved;
+    const originToken = req.cookies[cookieKey.toLowerCase()];
+    if (originToken) {
+      req.csrfToken = originToken;
+    } else {
+      const token = genToken();
+      req.csrfToken = token;
+      res.cookie(cookieKey, token, {
+        maxAge: cookieMaxAge,
+        path: cookiePath,
+        httpOnly: false,
+        secure: true,
+        sameSite: "none",
+        partitioned: true
+      });
+    }
+    next();
+  }, "csrfTokenMiddleware");
+}
+__name(createCsrfTokenMiddleware, "createCsrfTokenMiddleware");
+
+// src/middlewares/csrf-validation.ts
+function resolveOptions2(options) {
+  return {
+    headerKey: options.headerKey ?? "x-suda-csrf-token",
+    cookieKey: options.cookieKey ?? "suda-csrf-token"
+  };
+}
+__name(resolveOptions2, "resolveOptions");
+function sendForbidden(res, message) {
+  res.status(403).send(`Forbidden\uFF0C${message}`);
+}
+__name(sendForbidden, "sendForbidden");
+function createCsrfValidationMiddleware(options) {
+  const resolved = resolveOptions2(options ?? {});
+  return /* @__PURE__ */ __name(function csrfValidationMiddleware(req, res, next) {
+    const { headerKey, cookieKey } = resolved;
+    const cookieCsrfToken = req.cookies[cookieKey.toLowerCase()];
+    if (!cookieCsrfToken) {
+      sendForbidden(res, "csrf token not found in cookie.");
+      return;
+    }
+    const headerCsrfToken = req.headers[headerKey.toLowerCase()];
+    if (!headerCsrfToken) {
+      sendForbidden(res, "csrf token not found in header.");
+      return;
+    }
+    if (cookieCsrfToken !== headerCsrfToken) {
+      sendForbidden(res, "csrf token not match.");
+      return;
+    }
+    next();
+  }, "csrfValidationMiddleware");
+}
+__name(createCsrfValidationMiddleware, "createCsrfValidationMiddleware");
+
+// src/utils/platform-client.ts
+import { HttpClient } from "@lark-apaas/http-client";
+var _client = null;
+function createPlatformClient() {
+  if (_client) return _client;
+  _client = new HttpClient({
+    timeout: 5e3,
+    platform: {
+      enabled: true
+    }
+  });
+  return _client;
+}
+__name(createPlatformClient, "createPlatformClient");
+function getPlatformClient() {
+  if (!_client) {
+    throw new Error("Platform client not initialized. Call setup() first.");
+  }
+  return _client;
+}
+__name(getPlatformClient, "getPlatformClient");
+
+// src/utils/safe-escape.ts
+function safeStringify(obj) {
+  const json = JSON.stringify(obj);
+  return safeEscape(json);
+}
+__name(safeStringify, "safeStringify");
+function safeEscape(s) {
+  return s.replace(/[<>&='"\n\r\u2028\u2029]/g, function(c) {
+    switch (c.charCodeAt(0)) {
+      case 60:
+        return "\\u003c";
+      case 62:
+        return "\\u003e";
+      case 38:
+        return "\\u0026";
+      case 61:
+        return "\\u003d";
+      case 39:
+        return "\\u0027";
+      case 34:
+        return "\\u0022";
+      case 10:
+        return "\\u000a";
+      case 13:
+        return "\\u000d";
+      case 8232:
+        return "\\u2028";
+      case 8233:
+        return "\\u2029";
+      default:
+        return c;
+    }
+  });
+}
+__name(safeEscape, "safeEscape");
+
+// src/middlewares/view-context.ts
+async function getAppInfo(appId) {
+  if (!appId) {
+    console.warn("appId is empty, skip get app info");
+    return null;
+  }
+  try {
+    const client = getPlatformClient();
+    const resp = await client.get(`/b/${appId}/get_published_v2`);
+    if (resp.status !== 200) {
+      throw new Error(`Failed to get app info, status: ${resp.status}`);
+    }
+    const data = await resp.json();
+    if (data.status_code !== "0") {
+      throw new Error(`Failed to get app info, status_code: ${data.status_code}`);
+    }
+    return data.data.app_info ?? {};
+  } catch (err) {
+    console.error("Failed to get app info", err);
+    return null;
+  }
+}
+__name(getAppInfo, "getAppInfo");
+function mapToWindowEnvironment(input) {
+  const value = (input || "").trim().toLowerCase();
+  if (value === "boe") return "staging";
+  if (value === "pre") return "gray";
+  return "online";
+}
+__name(mapToWindowEnvironment, "mapToWindowEnvironment");
+function createViewContextMiddleware() {
+  return /* @__PURE__ */ __name(async function viewContextMiddleware(req, res, next) {
+    const { userId, tenantId, appId, loginUrl, userType } = req.userContext;
+    const csrfToken = req.csrfToken;
+    const appInfo = await getAppInfo(appId);
+    const environment = mapToWindowEnvironment(process.env.FORCE_FRAMEWORK_ENVIRONMENT);
+    req.__platform_data__ = {
+      csrfToken: csrfToken ?? "",
+      userId: userId ?? "",
+      appId: appId ?? "",
+      appName: safeEscape(appInfo?.app_name ?? ""),
+      appAvatar: appInfo?.app_avatar ?? "",
+      appDescription: safeEscape(appInfo?.app_description ?? ""),
+      loginUrl: loginUrl ?? "",
+      userType: userType ?? "",
+      tenantId,
+      environment
+    };
+    res.locals = {
+      ...res.locals ?? {},
+      csrfToken: csrfToken ?? "",
+      userId: userId ?? "",
+      tenantId: tenantId ?? "",
+      loginUrl: loginUrl ?? "",
+      userType: userType ?? "",
+      appId: appId ?? "",
+      appName: safeEscape(appInfo?.app_name ?? ""),
+      appAvatar: appInfo?.app_avatar ?? "",
+      appDescription: safeEscape(appInfo?.app_description ?? ""),
+      environment
+    };
+    next();
+  }, "viewContextMiddleware");
+}
+__name(createViewContextMiddleware, "createViewContextMiddleware");
+
+// src/setup.ts
+var db;
+function setup(app, config) {
+  const bodyLimit = config?.bodyLimit ?? process.env.BODY_SIZE_LIMIT ?? "1mb";
+  app.use(express.json({
+    limit: bodyLimit
+  }));
+  app.use(express.urlencoded({
+    limit: bodyLimit,
+    extended: true
+  }));
+  app.use(cookieParser());
+  app.use(userContextMiddleware);
+  const connectionString = config?.database?.connectionString ?? process.env.DATABASE_URL ?? "";
+  const { db: database, close } = createDatabase({
+    connectionString,
+    ...config?.database
+  });
+  db = database;
+  app.use(createRlsMiddleware());
+  const csrfEnabled = config?.csrf?.enabled ?? true;
+  if (csrfEnabled) {
+    const csrfRoutes = config?.csrf?.routes ?? [
+      "/api/*"
+    ];
+    app.use(createCsrfTokenMiddleware({
+      cookieKey: config?.csrf?.cookieKey,
+      cookieMaxAge: config?.csrf?.cookieMaxAge,
+      cookiePath: config?.csrf?.cookiePath,
+      exclude: csrfRoutes
+    }));
+    app.use(csrfRoutes, createCsrfValidationMiddleware({
+      headerKey: config?.csrf?.headerKey,
+      cookieKey: config?.csrf?.cookieKey
+    }));
+  }
+  createPlatformClient();
+  app.use(createViewContextMiddleware());
+  return {
+    close
+  };
+}
+__name(setup, "setup");
+export {
+  createCsrfTokenMiddleware,
+  createCsrfValidationMiddleware,
+  createViewContextMiddleware,
+  db,
+  safeEscape,
+  safeStringify,
+  setup,
+  userContextMiddleware
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/setup.ts","../src/middlewares/user-context.ts","../src/middlewares/csrf-token.ts","../src/middlewares/csrf-validation.ts","../src/utils/platform-client.ts","../src/utils/safe-escape.ts","../src/middlewares/view-context.ts"],"sourcesContent":["import express from 'express';\nimport cookieParser from 'cookie-parser';\nimport { createDatabase, createRlsMiddleware } from '@lark-apaas/express-datapaas';\nimport type { PostgresJsDatabase } from 'drizzle-orm/postgres-js';\n\nimport type { SetupConfig } from './types/config';\nimport { userContextMiddleware } from './middlewares/user-context';\nimport { createCsrfTokenMiddleware } from './middlewares/csrf-token';\nimport { createCsrfValidationMiddleware } from './middlewares/csrf-validation';\nimport { createViewContextMiddleware } from './middlewares/view-context';\nimport { createPlatformClient } from './utils/platform-client';\n\n// eslint-disable-next-line import/no-mutable-exports\nexport let db: PostgresJsDatabase;\n\nexport function setup(app: express.Application, config?: SetupConfig): { close: () => Promise<void> } {\n  const bodyLimit = config?.bodyLimit ?? process.env.BODY_SIZE_LIMIT ?? '1mb';\n\n  // 1. Body parsers\n  app.use(express.json({ limit: bodyLimit }));\n  app.use(express.urlencoded({ limit: bodyLimit, extended: true }));\n\n  // 2. Cookie parser\n  app.use(cookieParser());\n\n  // 3. UserContext (all routes)\n  app.use(userContextMiddleware);\n\n  // 4. Database + RLS\n  const connectionString = config?.database?.connectionString ?? process.env.DATABASE_URL ?? '';\n  const { db: database, close } = createDatabase({\n    connectionString,\n    ...config?.database,\n  });\n  db = database;\n  app.use(createRlsMiddleware());\n\n  // 5. CSRF\n  const csrfEnabled = config?.csrf?.enabled ?? true;\n  if (csrfEnabled) {\n    const csrfRoutes = config?.csrf?.routes ?? ['/api/*'];\n\n    // 页面路由生成 token（排除 API 路由），为后续 API 请求准备 cookie\n    app.use(createCsrfTokenMiddleware({\n      cookieKey: config?.csrf?.cookieKey,\n      cookieMaxAge: config?.csrf?.cookieMaxAge,\n      cookiePath: config?.csrf?.cookiePath,\n      exclude: csrfRoutes,\n    }));\n\n    // API 路由验证 token（cookie vs header）\n    app.use(csrfRoutes, createCsrfValidationMiddleware({\n      headerKey: config?.csrf?.headerKey,\n      cookieKey: config?.csrf?.cookieKey,\n    }));\n  }\n\n  // 6. Platform client + ViewContext\n  createPlatformClient();\n  app.use(createViewContextMiddleware());\n\n  return { close };\n}\n","import type { Request, Response, NextFunction } from 'express';\n\nconst SUDA_WEB_USER_HEADER_KEY = 'x-larkgw-suda-webuser';\n\ninterface SudaWebUser {\n  user_id: string;\n  tenant_id: number;\n  app_id: string;\n  login_url: string;\n  user_type: string;\n  env: 'preview' | 'runtime';\n  user_name: Record<string, string>;\n  is_system_account?: boolean;\n  roles?: string[];\n}\n\nfunction getWebUserFromHeader(req: Request): SudaWebUser | null {\n  const sudaWebUserContent = req.headers[SUDA_WEB_USER_HEADER_KEY] as string | undefined;\n  if (!sudaWebUserContent) {\n    return null;\n  }\n  try {\n    const sudaWebUserJsonStr = decodeURIComponent(sudaWebUserContent);\n    return JSON.parse(sudaWebUserJsonStr) as SudaWebUser;\n  } catch (err) {\n    console.error('parse suda webuser from header failed, err=%o', err);\n    return null;\n  }\n}\n\nexport function userContextMiddleware(req: Request, _res: Response, next: NextFunction) {\n  const webUser = getWebUserFromHeader(req);\n  req.userContext = {\n    userId: webUser?.user_id,\n    tenantId: webUser?.tenant_id,\n    appId: webUser?.app_id ?? '',\n    loginUrl: webUser?.login_url ?? '',\n    userType: webUser?.user_type ?? '',\n    env: webUser?.env ?? 'runtime',\n    userName: webUser?.user_name?.zh_cn ?? '',\n    userNameEn: webUser?.user_name?.en_us ?? '',\n    userNameI18n: webUser?.user_name ?? {},\n    isSystemAccount: webUser?.is_system_account ?? false,\n    roles: webUser?.roles,\n  };\n  next();\n}\n","import type { Request, Response, NextFunction } from 'express';\nimport crypto from 'crypto';\n\nexport interface CsrfTokenOptions {\n  cookieKey?: string;\n  cookieMaxAge?: number;\n  cookiePath?: string;\n  /** 排除的路由模式，匹配到则跳过 token 生成 */\n  exclude?: string[];\n}\n\ninterface ResolvedCsrfTokenOptions {\n  cookieKey: string;\n  cookieMaxAge: number;\n  cookiePath: string;\n  exclude: RegExp[];\n}\n\nfunction pathToRegex(pattern: string): RegExp {\n  // 将 Express 风格的路径模式转为正则：/api/* → /^\\/api\\/.*$/\n  const escaped = pattern\n    .replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n    .replace(/\\*/g, '.*');\n  return new RegExp(`^${escaped}$`);\n}\n\nfunction resolveOptions(options: CsrfTokenOptions): ResolvedCsrfTokenOptions {\n  return {\n    cookieKey: options.cookieKey ?? 'suda-csrf-token',\n    cookieMaxAge: options.cookieMaxAge ?? 1000 * 60 * 60 * 24 * 30,\n    cookiePath: options.cookiePath ?? '/',\n    exclude: (options.exclude ?? []).map(pathToRegex),\n  };\n}\n\nfunction genToken(): string {\n  const ts = Math.floor(Date.now() / 1000);\n  const randInt64 = BigInt('0x' + crypto.randomBytes(8).toString('hex')).toString();\n  const s = `${randInt64}.${ts}`;\n  const sha1 = crypto.createHash('sha1');\n  sha1.update(s);\n  return `${sha1.digest('hex')}-${ts}`;\n}\n\nexport function createCsrfTokenMiddleware(options?: CsrfTokenOptions) {\n  const resolved = resolveOptions(options ?? {});\n\n  return function csrfTokenMiddleware(req: Request, res: Response, next: NextFunction) {\n    // 匹配排除路由则跳过\n    const pathname = req.path;\n    if (resolved.exclude.some(re => re.test(pathname))) {\n      return next();\n    }\n\n    const { cookieKey, cookieMaxAge, cookiePath } = resolved;\n    const originToken = req.cookies[cookieKey.toLowerCase()];\n\n    if (originToken) {\n      req.csrfToken = originToken;\n    } else {\n      const token = genToken();\n      req.csrfToken = token;\n      res.cookie(cookieKey, token, {\n        maxAge: cookieMaxAge,\n        path: cookiePath,\n        httpOnly: false,\n        secure: true,\n        sameSite: 'none',\n        partitioned: true,\n      });\n    }\n    next();\n  };\n}\n","import type { Request, Response, NextFunction } from 'express';\n\nexport interface CsrfValidationOptions {\n  headerKey?: string;\n  cookieKey?: string;\n}\n\ninterface ResolvedCsrfValidationOptions {\n  headerKey: string;\n  cookieKey: string;\n}\n\nfunction resolveOptions(options: CsrfValidationOptions): ResolvedCsrfValidationOptions {\n  return {\n    headerKey: options.headerKey ?? 'x-suda-csrf-token',\n    cookieKey: options.cookieKey ?? 'suda-csrf-token',\n  };\n}\n\nfunction sendForbidden(res: Response, message: string) {\n  res.status(403).send(`Forbidden，${message}`);\n}\n\nexport function createCsrfValidationMiddleware(options?: CsrfValidationOptions) {\n  const resolved = resolveOptions(options ?? {});\n\n  return function csrfValidationMiddleware(req: Request, res: Response, next: NextFunction) {\n    const { headerKey, cookieKey } = resolved;\n\n    const cookieCsrfToken = req.cookies[cookieKey.toLowerCase()];\n    if (!cookieCsrfToken) {\n      sendForbidden(res, 'csrf token not found in cookie.');\n      return;\n    }\n\n    const headerCsrfToken = req.headers[headerKey.toLowerCase()];\n    if (!headerCsrfToken) {\n      sendForbidden(res, 'csrf token not found in header.');\n      return;\n    }\n\n    if (cookieCsrfToken !== headerCsrfToken) {\n      sendForbidden(res, 'csrf token not match.');\n      return;\n    }\n\n    next();\n  };\n}\n","import { HttpClient } from '@lark-apaas/http-client';\n\nlet _client: HttpClient | null = null;\n\nexport function createPlatformClient(): HttpClient {\n  if (_client) return _client;\n  _client = new HttpClient({\n    timeout: 5000,\n    platform: { enabled: true },\n  });\n  return _client;\n}\n\nexport function getPlatformClient(): HttpClient {\n  if (!_client) {\n    throw new Error('Platform client not initialized. Call setup() first.');\n  }\n  return _client;\n}\n","/**\n * 安全转义的 Json Stringify，模版渲染的 JSON 对象需要调用 safeStringify，而不是用原生的 JSON.stringify。\n * 抄 gson 的实现: https://github.com/google/gson/blob/49ddab9eeb6cbac686711deca6001d40e8d8500d/gson/src/main/java/com/google/gson/stream/JsonWriter.java\n * 将 json 的敏感字符转换为 unicode, 避免 xss\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport function safeStringify(obj: any) {\n  const json = JSON.stringify(obj);\n  return safeEscape(json);\n}\n\nenum EscapedChar {\n  LT = 0x3c, // <\n  GT = 0x3e, // >\n  AMP = 0x26, // &\n  APO = 0x27, // '\n  QUOT = 0x22, // \"\n  EQUAL = 0x3d, // =\n  LF = 0x0a, // \\n\n  CR = 0x0d, // \\r\n  LS = 0x2028, // 行分隔符\n  PS = 0x2029, // 段落分隔符\n}\n\nexport function safeEscape(s: string) {\n  return s.replace(/[<>&='\"\\n\\r\\u2028\\u2029]/g, function (c) {\n    switch (c.charCodeAt(0)) {\n      case EscapedChar.LT:\n        return '\\\\u003c';\n      case EscapedChar.GT:\n        return '\\\\u003e';\n      case EscapedChar.AMP:\n        return '\\\\u0026';\n      case EscapedChar.EQUAL:\n        return '\\\\u003d';\n      case EscapedChar.APO:\n        return '\\\\u0027';\n      case EscapedChar.QUOT:\n        return '\\\\u0022';\n      case EscapedChar.LF:\n        return '\\\\u000a';\n      case EscapedChar.CR:\n        return '\\\\u000d';\n      case EscapedChar.LS:\n        return '\\\\u2028';\n      case EscapedChar.PS:\n        return '\\\\u2029';\n      default:\n        return c;\n    }\n  });\n}\n","import type { Request, Response, NextFunction } from 'express';\nimport { getPlatformClient } from '../utils/platform-client';\nimport { safeEscape } from '../utils/safe-escape';\n\ninterface GetAppInfoResponse {\n  status_code: string;\n  data: {\n    status_code: number;\n    app_info: {\n      app_name: string;\n      app_description: string;\n      app_avatar: string;\n    };\n    app_runtime_extra: {\n      url: string;\n      bucket: string;\n    };\n  };\n}\n\nasync function getAppInfo(appId?: string) {\n  if (!appId) {\n    console.warn('appId is empty, skip get app info');\n    return null;\n  }\n  try {\n    const client = getPlatformClient();\n    const resp = await client.get(`/b/${appId}/get_published_v2`);\n    if (resp.status !== 200) {\n      throw new Error(`Failed to get app info, status: ${resp.status}`);\n    }\n    const data = (await resp.json()) as GetAppInfoResponse;\n    if (data.status_code !== '0') {\n      throw new Error(`Failed to get app info, status_code: ${data.status_code}`);\n    }\n    return data.data.app_info ?? {};\n  } catch (err) {\n    console.error('Failed to get app info', err);\n    return null;\n  }\n}\n\nfunction mapToWindowEnvironment(input?: string): string {\n  const value = (input || '').trim().toLowerCase();\n  if (value === 'boe') return 'staging';\n  if (value === 'pre') return 'gray';\n  return 'online';\n}\n\nexport function createViewContextMiddleware() {\n  return async function viewContextMiddleware(req: Request, res: Response, next: NextFunction) {\n    const { userId, tenantId, appId, loginUrl, userType } = req.userContext;\n    const csrfToken = req.csrfToken;\n    const appInfo = await getAppInfo(appId);\n    const environment = mapToWindowEnvironment(process.env.FORCE_FRAMEWORK_ENVIRONMENT);\n\n    req.__platform_data__ = {\n      csrfToken: csrfToken ?? '',\n      userId: userId ?? '',\n      appId: appId ?? '',\n      appName: safeEscape(appInfo?.app_name ?? ''),\n      appAvatar: appInfo?.app_avatar ?? '',\n      appDescription: safeEscape(appInfo?.app_description ?? ''),\n      loginUrl: loginUrl ?? '',\n      userType: userType ?? '',\n      tenantId,\n      environment,\n    };\n\n    res.locals = {\n      ...(res.locals ?? {}),\n      csrfToken: csrfToken ?? '',\n      userId: userId ?? '',\n      tenantId: tenantId ?? '',\n      loginUrl: loginUrl ?? '',\n      userType: userType ?? '',\n      appId: appId ?? '',\n      appName: safeEscape(appInfo?.app_name ?? ''),\n      appAvatar: appInfo?.app_avatar ?? '',\n      appDescription: safeEscape(appInfo?.app_description ?? ''),\n      environment,\n    };\n\n    next();\n  };\n}\n"],"mappings":";;;;AAAA,OAAOA,aAAa;AACpB,OAAOC,kBAAkB;AACzB,SAASC,gBAAgBC,2BAA2B;;;ACApD,IAAMC,2BAA2B;AAcjC,SAASC,qBAAqBC,KAAY;AACxC,QAAMC,qBAAqBD,IAAIE,QAAQJ,wBAAAA;AACvC,MAAI,CAACG,oBAAoB;AACvB,WAAO;EACT;AACA,MAAI;AACF,UAAME,qBAAqBC,mBAAmBH,kBAAAA;AAC9C,WAAOI,KAAKC,MAAMH,kBAAAA;EACpB,SAASI,KAAK;AACZC,YAAQC,MAAM,iDAAiDF,GAAAA;AAC/D,WAAO;EACT;AACF;AAZSR;AAcF,SAASW,sBAAsBV,KAAcW,MAAgBC,MAAkB;AACpF,QAAMC,UAAUd,qBAAqBC,GAAAA;AACrCA,MAAIc,cAAc;IAChBC,QAAQF,SAASG;IACjBC,UAAUJ,SAASK;IACnBC,OAAON,SAASO,UAAU;IAC1BC,UAAUR,SAASS,aAAa;IAChCC,UAAUV,SAASW,aAAa;IAChCC,KAAKZ,SAASY,OAAO;IACrBC,UAAUb,SAASc,WAAWC,SAAS;IACvCC,YAAYhB,SAASc,WAAWG,SAAS;IACzCC,cAAclB,SAASc,aAAa,CAAC;IACrCK,iBAAiBnB,SAASoB,qBAAqB;IAC/CC,OAAOrB,SAASqB;EAClB;AACAtB,OAAAA;AACF;AAhBgBF;;;AC7BhB,OAAOyB,YAAY;AAiBnB,SAASC,YAAYC,SAAe;AAElC,QAAMC,UAAUD,QACbE,QAAQ,sBAAsB,MAAA,EAC9BA,QAAQ,OAAO,IAAA;AAClB,SAAO,IAAIC,OAAO,IAAIF,OAAAA,GAAU;AAClC;AANSF;AAQT,SAASK,eAAeC,SAAyB;AAC/C,SAAO;IACLC,WAAWD,QAAQC,aAAa;IAChCC,cAAcF,QAAQE,gBAAgB,MAAO,KAAK,KAAK,KAAK;IAC5DC,YAAYH,QAAQG,cAAc;IAClCC,UAAUJ,QAAQI,WAAW,CAAA,GAAIC,IAAIX,WAAAA;EACvC;AACF;AAPSK;AAST,SAASO,WAAAA;AACP,QAAMC,KAAKC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;AACnC,QAAMC,YAAYC,OAAO,OAAOC,OAAOC,YAAY,CAAA,EAAGC,SAAS,KAAA,CAAA,EAAQA,SAAQ;AAC/E,QAAMC,IAAI,GAAGL,SAAAA,IAAaL,EAAAA;AAC1B,QAAMW,OAAOJ,OAAOK,WAAW,MAAA;AAC/BD,OAAKE,OAAOH,CAAAA;AACZ,SAAO,GAAGC,KAAKG,OAAO,KAAA,CAAA,IAAUd,EAAAA;AAClC;AAPSD;AASF,SAASgB,0BAA0BtB,SAA0B;AAClE,QAAMuB,WAAWxB,eAAeC,WAAW,CAAC,CAAA;AAE5C,SAAO,gCAASwB,oBAAoBC,KAAcC,KAAeC,MAAkB;AAEjF,UAAMC,WAAWH,IAAII;AACrB,QAAIN,SAASnB,QAAQ0B,KAAKC,CAAAA,OAAMA,GAAGC,KAAKJ,QAAAA,CAAAA,GAAY;AAClD,aAAOD,KAAAA;IACT;AAEA,UAAM,EAAE1B,WAAWC,cAAcC,WAAU,IAAKoB;AAChD,UAAMU,cAAcR,IAAIS,QAAQjC,UAAUkC,YAAW,CAAA;AAErD,QAAIF,aAAa;AACfR,UAAIW,YAAYH;IAClB,OAAO;AACL,YAAMI,QAAQ/B,SAAAA;AACdmB,UAAIW,YAAYC;AAChBX,UAAIY,OAAOrC,WAAWoC,OAAO;QAC3BE,QAAQrC;QACR2B,MAAM1B;QACNqC,UAAU;QACVC,QAAQ;QACRC,UAAU;QACVC,aAAa;MACf,CAAA;IACF;AACAhB,SAAAA;EACF,GAzBO;AA0BT;AA7BgBL;;;AChChB,SAASsB,gBAAeC,SAA8B;AACpD,SAAO;IACLC,WAAWD,QAAQC,aAAa;IAChCC,WAAWF,QAAQE,aAAa;EAClC;AACF;AALSH,OAAAA,iBAAAA;AAOT,SAASI,cAAcC,KAAeC,SAAe;AACnDD,MAAIE,OAAO,GAAA,EAAKC,KAAK,kBAAaF,OAAAA,EAAS;AAC7C;AAFSF;AAIF,SAASK,+BAA+BR,SAA+B;AAC5E,QAAMS,WAAWV,gBAAeC,WAAW,CAAC,CAAA;AAE5C,SAAO,gCAASU,yBAAyBC,KAAcP,KAAeQ,MAAkB;AACtF,UAAM,EAAEX,WAAWC,UAAS,IAAKO;AAEjC,UAAMI,kBAAkBF,IAAIG,QAAQZ,UAAUa,YAAW,CAAA;AACzD,QAAI,CAACF,iBAAiB;AACpBV,oBAAcC,KAAK,iCAAA;AACnB;IACF;AAEA,UAAMY,kBAAkBL,IAAIM,QAAQhB,UAAUc,YAAW,CAAA;AACzD,QAAI,CAACC,iBAAiB;AACpBb,oBAAcC,KAAK,iCAAA;AACnB;IACF;AAEA,QAAIS,oBAAoBG,iBAAiB;AACvCb,oBAAcC,KAAK,uBAAA;AACnB;IACF;AAEAQ,SAAAA;EACF,GArBO;AAsBT;AAzBgBJ;;;ACvBhB,SAASU,kBAAkB;AAE3B,IAAIC,UAA6B;AAE1B,SAASC,uBAAAA;AACd,MAAID,QAAS,QAAOA;AACpBA,YAAU,IAAIE,WAAW;IACvBC,SAAS;IACTC,UAAU;MAAEC,SAAS;IAAK;EAC5B,CAAA;AACA,SAAOL;AACT;AAPgBC;AAST,SAASK,oBAAAA;AACd,MAAI,CAACN,SAAS;AACZ,UAAM,IAAIO,MAAM,sDAAA;EAClB;AACA,SAAOP;AACT;AALgBM;;;ACPT,SAASE,cAAcC,KAAQ;AACpC,QAAMC,OAAOC,KAAKC,UAAUH,GAAAA;AAC5B,SAAOI,WAAWH,IAAAA;AACpB;AAHgBF;AAkBT,SAASM,WAAWC,GAAS;AAClC,SAAOA,EAAEC,QAAQ,6BAA6B,SAAUC,GAAC;AACvD,YAAQA,EAAEC,WAAW,CAAA,GAAA;MACnB,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT,KAAA;AACE,eAAO;MACT;AACE,eAAOD;IACX;EACF,CAAA;AACF;AA3BgBH;;;ACJhB,eAAeK,WAAWC,OAAc;AACtC,MAAI,CAACA,OAAO;AACVC,YAAQC,KAAK,mCAAA;AACb,WAAO;EACT;AACA,MAAI;AACF,UAAMC,SAASC,kBAAAA;AACf,UAAMC,OAAO,MAAMF,OAAOG,IAAI,MAAMN,KAAAA,mBAAwB;AAC5D,QAAIK,KAAKE,WAAW,KAAK;AACvB,YAAM,IAAIC,MAAM,mCAAmCH,KAAKE,MAAM,EAAE;IAClE;AACA,UAAME,OAAQ,MAAMJ,KAAKK,KAAI;AAC7B,QAAID,KAAKE,gBAAgB,KAAK;AAC5B,YAAM,IAAIH,MAAM,wCAAwCC,KAAKE,WAAW,EAAE;IAC5E;AACA,WAAOF,KAAKA,KAAKG,YAAY,CAAC;EAChC,SAASC,KAAK;AACZZ,YAAQa,MAAM,0BAA0BD,GAAAA;AACxC,WAAO;EACT;AACF;AApBed;AAsBf,SAASgB,uBAAuBC,OAAc;AAC5C,QAAMC,SAASD,SAAS,IAAIE,KAAI,EAAGC,YAAW;AAC9C,MAAIF,UAAU,MAAO,QAAO;AAC5B,MAAIA,UAAU,MAAO,QAAO;AAC5B,SAAO;AACT;AALSF;AAOF,SAASK,8BAAAA;AACd,SAAO,sCAAeC,sBAAsBC,KAAcC,KAAeC,MAAkB;AACzF,UAAM,EAAEC,QAAQC,UAAU1B,OAAO2B,UAAUC,SAAQ,IAAKN,IAAIO;AAC5D,UAAMC,YAAYR,IAAIQ;AACtB,UAAMC,UAAU,MAAMhC,WAAWC,KAAAA;AACjC,UAAMgC,cAAcjB,uBAAuBkB,QAAQC,IAAIC,2BAA2B;AAElFb,QAAIc,oBAAoB;MACtBN,WAAWA,aAAa;MACxBL,QAAQA,UAAU;MAClBzB,OAAOA,SAAS;MAChBqC,SAASC,WAAWP,SAASQ,YAAY,EAAA;MACzCC,WAAWT,SAASU,cAAc;MAClCC,gBAAgBJ,WAAWP,SAASY,mBAAmB,EAAA;MACvDhB,UAAUA,YAAY;MACtBC,UAAUA,YAAY;MACtBF;MACAM;IACF;AAEAT,QAAIqB,SAAS;MACX,GAAIrB,IAAIqB,UAAU,CAAC;MACnBd,WAAWA,aAAa;MACxBL,QAAQA,UAAU;MAClBC,UAAUA,YAAY;MACtBC,UAAUA,YAAY;MACtBC,UAAUA,YAAY;MACtB5B,OAAOA,SAAS;MAChBqC,SAASC,WAAWP,SAASQ,YAAY,EAAA;MACzCC,WAAWT,SAASU,cAAc;MAClCC,gBAAgBJ,WAAWP,SAASY,mBAAmB,EAAA;MACvDX;IACF;AAEAR,SAAAA;EACF,GAlCO;AAmCT;AApCgBJ;;;ANpCT,IAAIyB;AAEJ,SAASC,MAAMC,KAA0BC,QAAoB;AAClE,QAAMC,YAAYD,QAAQC,aAAaC,QAAQC,IAAIC,mBAAmB;AAGtEL,MAAIM,IAAIC,QAAQC,KAAK;IAAEC,OAAOP;EAAU,CAAA,CAAA;AACxCF,MAAIM,IAAIC,QAAQG,WAAW;IAAED,OAAOP;IAAWS,UAAU;EAAK,CAAA,CAAA;AAG9DX,MAAIM,IAAIM,aAAAA,CAAAA;AAGRZ,MAAIM,IAAIO,qBAAAA;AAGR,QAAMC,mBAAmBb,QAAQc,UAAUD,oBAAoBX,QAAQC,IAAIY,gBAAgB;AAC3F,QAAM,EAAElB,IAAIiB,UAAUE,MAAK,IAAKC,eAAe;IAC7CJ;IACA,GAAGb,QAAQc;EACb,CAAA;AACAjB,OAAKiB;AACLf,MAAIM,IAAIa,oBAAAA,CAAAA;AAGR,QAAMC,cAAcnB,QAAQoB,MAAMC,WAAW;AAC7C,MAAIF,aAAa;AACf,UAAMG,aAAatB,QAAQoB,MAAMG,UAAU;MAAC;;AAG5CxB,QAAIM,IAAImB,0BAA0B;MAChCC,WAAWzB,QAAQoB,MAAMK;MACzBC,cAAc1B,QAAQoB,MAAMM;MAC5BC,YAAY3B,QAAQoB,MAAMO;MAC1BC,SAASN;IACX,CAAA,CAAA;AAGAvB,QAAIM,IAAIiB,YAAYO,+BAA+B;MACjDC,WAAW9B,QAAQoB,MAAMU;MACzBL,WAAWzB,QAAQoB,MAAMK;IAC3B,CAAA,CAAA;EACF;AAGAM,uBAAAA;AACAhC,MAAIM,IAAI2B,4BAAAA,CAAAA;AAER,SAAO;IAAEhB;EAAM;AACjB;AA/CgBlB;","names":["express","cookieParser","createDatabase","createRlsMiddleware","SUDA_WEB_USER_HEADER_KEY","getWebUserFromHeader","req","sudaWebUserContent","headers","sudaWebUserJsonStr","decodeURIComponent","JSON","parse","err","console","error","userContextMiddleware","_res","next","webUser","userContext","userId","user_id","tenantId","tenant_id","appId","app_id","loginUrl","login_url","userType","user_type","env","userName","user_name","zh_cn","userNameEn","en_us","userNameI18n","isSystemAccount","is_system_account","roles","crypto","pathToRegex","pattern","escaped","replace","RegExp","resolveOptions","options","cookieKey","cookieMaxAge","cookiePath","exclude","map","genToken","ts","Math","floor","Date","now","randInt64","BigInt","crypto","randomBytes","toString","s","sha1","createHash","update","digest","createCsrfTokenMiddleware","resolved","csrfTokenMiddleware","req","res","next","pathname","path","some","re","test","originToken","cookies","toLowerCase","csrfToken","token","cookie","maxAge","httpOnly","secure","sameSite","partitioned","resolveOptions","options","headerKey","cookieKey","sendForbidden","res","message","status","send","createCsrfValidationMiddleware","resolved","csrfValidationMiddleware","req","next","cookieCsrfToken","cookies","toLowerCase","headerCsrfToken","headers","HttpClient","_client","createPlatformClient","HttpClient","timeout","platform","enabled","getPlatformClient","Error","safeStringify","obj","json","JSON","stringify","safeEscape","safeEscape","s","replace","c","charCodeAt","getAppInfo","appId","console","warn","client","getPlatformClient","resp","get","status","Error","data","json","status_code","app_info","err","error","mapToWindowEnvironment","input","value","trim","toLowerCase","createViewContextMiddleware","viewContextMiddleware","req","res","next","userId","tenantId","loginUrl","userType","userContext","csrfToken","appInfo","environment","process","env","FORCE_FRAMEWORK_ENVIRONMENT","__platform_data__","appName","safeEscape","app_name","appAvatar","app_avatar","appDescription","app_description","locals","db","setup","app","config","bodyLimit","process","env","BODY_SIZE_LIMIT","use","express","json","limit","urlencoded","extended","cookieParser","userContextMiddleware","connectionString","database","DATABASE_URL","close","createDatabase","createRlsMiddleware","csrfEnabled","csrf","enabled","csrfRoutes","routes","createCsrfTokenMiddleware","cookieKey","cookieMaxAge","cookiePath","exclude","createCsrfValidationMiddleware","headerKey","createPlatformClient","createViewContextMiddleware"]}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@lark-apaas/express-core",
+  "version": "0.0.1",
+  "description": "Express core framework with platform middleware integration",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT",
+  "keywords": [
+    "plugin",
+    "express",
+    "server",
+    "typescript",
+    "middleware",
+    "platform"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "clean": "rm -rf dist",
+    "lint": "eslint src/**/*.ts",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest --watch",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@lark-apaas/express-datapaas": "^0.0.1",
+    "@lark-apaas/http-client": "^0.1.2",
+    "cookie-parser": "^1.4.7"
+  },
+  "devDependencies": {
+    "@types/cookie-parser": "^1.4.9",
+    "@types/express": "^5.0.0",
+    "@types/node": "^20.0.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.0.0",
+    "vitest": "^3.2.4"
+  },
+  "peerDependencies": {
+    "drizzle-orm": "0.44.6",
+    "express": "^4.0.0 || ^5.0.0"
+  }
+}